Adaptive security monitoring methods, systems, and software products

Abstract

This application discloses an adaptive security monitoring method, system, and program product. The method includes: determining the distribution location and number of multiple probe points based on the execution attribute information of the access process, and using the multiple probe points to acquire the runtime data generated by the access process during execution; determining the anomaly analysis results of the access process based on the security event characteristics of the access process represented by the runtime data, and obtaining the detection results of the corresponding attack behaviors of the access process based on preset attack characteristics; and generating security monitoring information for the access process based on the anomaly analysis results and the detection results. This method can dynamically deploy probe points targeting the access process to adapt to dynamically changing network environments and security threats; at the same time, through matching and analysis of anomaly analysis results with multi-dimensional data of preset attack characteristics, it achieves accurate determination of attack behaviors, reduces the false negative or false positive rate of attack behaviors, and thus improves the security monitoring effect of data.

Description

Technical Field

[0001] This application relates to the field of data security technology, specifically to an adaptive security monitoring method, system, and program product. Background Technology

[0002] Currently, with the rapid development of information technology, security threats are becoming increasingly complex and varied. In response, existing technologies typically employ static detection points during system operation, collecting data at fixed frequencies and lengths to achieve secure data monitoring.

[0003] However, the aforementioned security monitoring methods struggle to cope with dynamically changing attack behaviors and the evolving needs of kernel versions and users. Therefore, existing technologies still suffer from poor data security monitoring effectiveness. Summary of the Invention

[0004] In view of the above-mentioned defects or deficiencies in the existing technology, it is desirable to provide an adaptive security monitoring method, system and program product. This method can dynamically deploy probe points for access processes to adapt to the dynamically changing network environment and security threats. At the same time, by matching and analyzing the anomaly analysis results with multi-dimensional data of preset attack characteristics, it can accurately determine the attack behavior, reduce the false negative or false positive rate of attack behavior, and thus improve the security monitoring effect of data.

[0005] In a first aspect, the present invention provides an adaptive security monitoring method, the method comprising:

[0006] Based on the execution attribute information of the access process, determine the distribution location and number of multiple probe points, and use multiple probe points to obtain the running data generated by the access process during execution;

[0007] Based on the security event characteristics of the access process represented by the runtime data, the abnormal analysis results of the access process are determined, and the detection results of the corresponding attack behavior of the access process are obtained based on the preset attack characteristics.

[0008] Security monitoring information for the access process is generated based on the anomaly analysis and detection results; the security monitoring information includes at least the detection results of attack threat events.

[0009] In one possible implementation, multiple probe points are used to acquire runtime data generated during the execution of the access process, including:

[0010] Based on the execution attribute information, adjust the acquisition rules for multiple probe points, and acquire the runtime data generated by the access process during execution based on the adjusted acquisition rules;

[0011] The acquisition rules include at least the acquisition frequency, the acquisition data type, and the acquisition data weight. The acquisition data weight is used to characterize the degree of correlation between the acquired data and the monitoring target.

[0012] In one possible implementation, the anomaly analysis results of the access process are determined based on the security event characteristics of the access process as represented by runtime data, including:

[0013] Based on the temporal and statistical characteristics of security event features, construct a behavioral baseline for the access process.

[0014] Anomaly detection is performed based on behavioral baselines to obtain anomaly analysis results for the access process.

[0015] In one possible implementation, the detection results of the attack behavior corresponding to the access process are obtained based on preset attack characteristics, including:

[0016] Based on preset attack characteristics, the attack behavior and attack process corresponding to the access process are reconstructed to obtain the detection results of the attack behavior corresponding to the access process.

[0017] In one possible implementation, the method also includes:

[0018] Based on the distribution location, number of distribution points and acquisition rules of multiple detection points, the operational data is preprocessed to determine the anomaly analysis results of the access process based on the preprocessed operational data.

[0019] In one possible implementation, the preset attack signature is formed based on the results of historical anomaly analysis, or it is composed of attack behaviors in a historical attack database.

[0020] In one possible implementation, the distribution locations and number of multiple probe points are determined based on the execution attribute information of the accessing process, including:

[0021] When the risk level of the access process represented by the execution attribute information is higher than the preset risk threshold, the number of probe points is increased;

[0022] When the frequency of calls to the process that represents the execution attribute information is higher than the preset call frequency, the number of probe points is increased.

[0023] Secondly, an adaptive security monitoring system is provided, which includes an adaptive security monitoring module and a dynamic security analysis module.

[0024] The adaptive security monitoring module is used to determine the distribution location and number of multiple probe points based on the execution attribute information of the access process, and to use the multiple probe points to obtain the running data generated by the access process during execution.

[0025] The dynamic security analysis module is used to determine the abnormal analysis results of the access process based on the security event characteristics of the access process represented by the running data, and to obtain the detection results of the corresponding attack behavior of the access process based on the preset attack characteristics.

[0026] The dynamic security analysis module is also used to generate security monitoring information for access processes based on anomaly analysis results and detection results; the security monitoring information includes at least the detection results of attack threat events.

[0027] In one possible implementation, the system also includes a circular buffer for storing runtime data acquired by the adaptive security monitoring module for reading by the dynamic security analysis module.

[0028] Thirdly, a computer program product is provided, which includes instructions that, when executed, perform the method described in any one of the first aspects.

[0029] Fourthly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements the method described in any one of the first aspects above.

[0030] Fifthly, a computer-readable storage medium is provided having a computer program stored thereon, characterized in that the program, when executed by a processor, implements the method described in any one of the first aspects above.

[0031] The adaptive security monitoring method, system, and program products provided in this application, on the one hand, dynamically deploy probe points for access processes based on the execution attribute information of the access process, so as to adapt to the dynamically changing network environment and security threats; on the other hand, through real-time correlation analysis of anomaly analysis results (i.e., corresponding production end behavior characteristics) and preset attack characteristics (i.e., corresponding attack end characteristic library) multi-dimensional data, the accurate determination of attack behavior is achieved, reducing the false negative or false positive rate of attack behavior, thereby improving the security monitoring effect of data. Attached Figure Description

[0032] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0033] Figure 1 This is a schematic diagram of the distribution of an adaptive security monitoring system provided in an embodiment of this application;

[0034] Figure 2 This is a flowchart illustrating an adaptive security monitoring method provided in an embodiment of this application;

[0035] Figure 3This is a schematic diagram illustrating the execution of the adaptive security monitoring module 11 provided in this application embodiment;

[0036] Figure 4 This is another schematic diagram of the distribution of the adaptive security monitoring system 10 provided in the embodiments of this application;

[0037] Figure 5 This is a schematic diagram illustrating the execution of the dynamic security analysis module 12 provided in this embodiment of the application;

[0038] Figure 6 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0039] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0040] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The present application will now be described in detail with reference to the accompanying drawings and embodiments. Furthermore, the term "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The terms "first" and "second," etc., in the specification and claims of the embodiments of this application are used to distinguish different objects, not to describe a specific order of objects.

[0041] The following is an explanation of the terms used in this application:

[0042] (1) eBPF technology: an in-kernel sandbox virtual machine technology (Extended Berkeley PacketFilter), which allows userspace programs to safely and efficiently load and execute custom code into kernel space without modifying the kernel or loading kernel modules;

[0043] To address the aforementioned issue of poor data security monitoring effectiveness, existing technologies offer various approaches, including data analysis based on security policies, real-time tracking and analysis of network behavior and system calls using network scanning technology, and adaptive network threat evolution by combining multiple detection algorithms.

[0044] However, in security monitoring methods that rely on security policies for data analysis, statically deploying probes and using eBPF as the detection method has limitations such as fixed probe location and number, and poor compatibility of eBPF with older kernel versions. Using fixed collection strategies for data collection results in lengthy data collection processes and high resource consumption. Furthermore, the security policies involved in this approach only analyze production-side data, leading to a relatively singular analytical dimension. In methods that utilize network scanning technology to track and analyze network behavior and system calls in real time, the detection method of deploying scripts or proxies in the target system to capture abnormal behavior and infer vulnerability locations is relatively fixed, unable to dynamically select detection methods based on system version or user needs; and it cannot dynamically adjust data collection rules. Methods that combine multiple detection algorithms to adapt to network threat evolution rely on a dynamic evaluation model built from data collected by a preset fixed number of probes, also suffering from the problem of fixed probes and the inability to dynamically adjust them.

[0045] In addition, current analysis techniques for security incident-related data are usually limited to single-dimensional data analysis (e.g., analyzing only production data or attack data), lacking comprehensive analysis of multi-dimensional data and real-time threat detection capabilities.

[0046] As a result, existing technologies still suffer from poor data security monitoring during system operation.

[0047] In view of the above problems, embodiments of this application provide an adaptive security monitoring method, system, and program product that overcomes or at least partially solves the above problems. The method dynamically deploys probe points for access processes and achieves accurate determination of attack behavior by matching and analyzing anomaly analysis results with multi-dimensional data of preset attack characteristics. It can also adapt to dynamically changing network environments and security threats, thereby improving the security monitoring effect of data.

[0048] It should be noted that although the operation of the method of the present invention is described in a specific order in the accompanying drawings, this does not require or imply that the operations must be performed in that specific order, or that all the operations shown must be performed in order to achieve the desired result.

[0049] In one possible implementation, the automatic device network configuration method provided in this application is applicable to an adaptive security monitoring system. For example, Figure 1 This is a schematic diagram of the distribution of the adaptive security monitoring system 10 provided in the embodiments of this application, such as... Figure 1 As shown, the adaptive security monitoring system 10 includes an adaptive security monitoring module 11 and a dynamic security analysis module 12, which are deployed on computer equipment to achieve data security monitoring.

[0050] For example, the adaptive security monitoring module 11 is used to acquire the running data generated during the execution of the access process, that is, the adaptive security monitoring module 11 can also be called a data acquisition module; the dynamic security analysis module 12 is used to analyze and process the running data acquired by the adaptive security monitoring module 11, and determine the abnormal attack behavior of the access process in combination with preset attack features, wherein the preset attack features can be obtained from the attack end feature library.

[0051] Specifically, the aforementioned attack signature database is used to store, classify, and manage feature data of known attack behaviors. It is a structured database or knowledge base. Its core is to collect and analyze historical attack samples (e.g., malicious code, vulnerability exploitation patterns, network attack traffic, etc.) to extract identifiable attack features (e.g., signatures, behavioral patterns, abnormal indicators, etc.) to form a standardized set of threat intelligence.

[0052] For example, the attack signature database can be formed based on the results of historical anomaly analysis, or it can be composed of attack behaviors in the historical attack database; the historical attack database can be an existing historical attack database, or it can be composed of vulnerabilities or attack methods manually imported from the Linux community.

[0053] In the specific implementation, refer to Figure 1 The adaptive security monitoring module 11 acquires the running data generated during the execution of the access process and sends the acquired running data to the dynamic security analysis module 12. After receiving the running data, the dynamic security analysis module 12 analyzes and processes the running data to determine whether the access process is in an abnormal state. At the same time, it performs attack behavior matching based on the preset attack features in the attack end feature library, thereby obtaining the security monitoring information of the access process by combining the judgment result of the abnormal state and the matching result of the attack behavior.

[0054] Figure 2 This is a schematic flowchart of an automatic network configuration method for devices provided in an embodiment of this application, such as... Figure 2 As shown, the method specifically includes the following steps:

[0055] Step S201: Based on the execution attribute information of the access process, determine the distribution location and number of multiple probe points, and use the multiple probe points to obtain the running data generated by the access process during execution.

[0056] Among them, the probe point is a static probe point used to monitor the status of the access process during system operation and whose status is relatively stable.

[0057] Specifically, the static probe points are mainly focused on system calls, such as system call functions.

[0058] In one possible implementation, when a certain access process is executed, multiple probe points can be dynamically deployed based on the execution attribute information of the access process.

[0059] For example, the execution attribute information of the access process corresponds to the system monitoring information and performance management information for the access process, specifically including risk level, call frequency, system usage time, high-frequency usage time nodes and system load, etc. This application does not impose specific limitations on this.

[0060] Specifically, monitoring targets can be dynamically deployed based on information such as the risk level, call frequency, and system usage time.

[0061] Correspondingly, when a certain execution attribute information differs significantly from the average level under normal circumstances, the number of detection points distributed within that abnormal part is increased.

[0062] For example, when the risk level of the access process represented by the execution attribute information is higher than the preset risk threshold (i.e., a high-risk period), the distribution locations of multiple probe points are concentrated in that high-risk period, and the distribution density of probe points in that period is increased.

[0063] When the frequency of calls to the process that represents the execution attribute information is higher than the preset call frequency (i.e., the high-frequency call area), the distribution of multiple probe points is concentrated in the high-frequency call area, and the distribution density of probe points in the area is increased.

[0064] For example, the monitoring method for the probe points can be dynamically selected according to the system version or user needs. This monitoring method includes, but is not limited to, eBPF technology, kernel modules, etc.

[0065] Alternatively, machine learning algorithms can be used to build a probe point deployment model to directly output the distribution information of the probe points.

[0066] Compared to existing static monitoring strategies that cannot adapt to dynamically changing network environments and security threats, this embodiment achieves adaptive security monitoring of access processes by dynamically adjusting detection points and data collection strategies based on system status and user needs, thereby improving monitoring efficiency and accuracy.

[0067] In one possible implementation, the acquisition rules for multiple probe points can be adjusted based on the execution attribute information of the access process, and the running data generated by the access process during execution can be obtained based on the adjusted acquisition rules.

[0068] For example, the acquisition rules for multiple detection points can be dynamically adjusted based on information such as risk level, high-frequency usage time points, and system load.

[0069] Specifically, the above acquisition rules include at least the acquisition frequency of the detection points, the type of data acquired (i.e., the richness of information), and the weight of the acquired data, which is used to characterize the strength of the correlation between the acquired data and the monitoring target.

[0070] For example, if the current time period can be determined to be a high-incidence period for attacks based on the execution attribute information, then the rule for obtaining the probe points is to increase the data acquisition frequency and data acquisition type (i.e., richness).

[0071] For example, when the current monitoring target is determined to be network information, the acquisition rule for the detection point is to increase the attention to system call information related to the network and reduce the collection and analysis of information that is not strongly related to the network. That is, increase the acquisition weight of system call information related to the network and decrease the acquisition weight of information that is not strongly related to the network.

[0072] Alternatively, a reinforcement learning model can be used to construct an acquisition rule output model to directly output the acquisition rules for probe points.

[0073] Compared to existing technologies where fixed data collection strategies lead to resource waste under high loads or insufficient monitoring during critical periods, this embodiment dynamically adjusts the richness, frequency, and weight of collected information by combining system status and usage scenarios. This reduces system overhead and enhances the flexibility and dynamism of security protection.

[0074] Step S202: Based on the security event characteristics of the access process represented by the running data, determine the abnormal analysis results of the access process, and obtain the detection results of the corresponding attack behavior of the access process based on the preset attack characteristics.

[0075] Among them, the security event characteristics of the access process refer to the environmental data characteristics and associated data characteristics (i.e., context information) related to the security event corresponding to the access process, specifically including the call stack, parent process, call chain, resource access, and permissions.

[0076] One possible implementation is to construct a behavioral baseline for the access process based on the temporal and statistical characteristics of security event features, and then perform anomaly detection based on the behavioral baseline to obtain anomaly analysis results for the access process.

[0077] For example, by mining the temporal patterns of security event features, the temporal characteristics of security event features can be determined to identify the regularity of system behavior (e.g., periodic calls, abnormal event chains); wherein, the temporal pattern mining can analyze the repetitive or correlated patterns in time series data (e.g., logs, information streams).

[0078] For example, statistical models such as probability distributions, hypothesis testing, or machine learning algorithms can be used to extract quantitative features (e.g., mean, clustering) from data to construct interpretable models describing system behavior.

[0079] Based on this, a behavioral baseline corresponding to the access process can be constructed according to the regularity of the above system behavior and the system behavior description model. This behavioral baseline can be used to characterize the statistical analysis results of the system, network, user, file access status, etc. when the system is running normally.

[0080] For example, security event characteristics can be compared with preset attack characteristics (i.e., the aforementioned attack signature database) to determine the abnormal analysis result of the access process based on the data comparison result; for example, when the data comparison is successful, the abnormal analysis result of the access process is determined to be abnormal.

[0081] In one possible implementation, the attack behavior and attack process corresponding to the access process can be reconstructed based on preset attack characteristics to obtain the detection results of the attack behavior corresponding to the access process.

[0082] For example, based on preset attack characteristics, the attack can be systematically reconstructed from the initial attack to the successful attack, so as to restore the entire attack process and its attack behavior (i.e., to restore the attack chain).

[0083] Step S203: Generate security monitoring information for the access process based on the anomaly analysis results and detection results; the security monitoring information includes at least the detection results of attack threat events.

[0084] For example, based on the anomaly analysis results and detection results, analysis results and response suggestions for attack threat events can be generated, and the analysis results and response suggestions can be sent to a visualization interface or output as a threat event analysis document.

[0085] In another embodiment of this application, a complete implementation process for the adaptive security monitoring module 11 is also provided.

[0086] For example, Figure 3 This is a schematic diagram illustrating the execution of the adaptive security monitoring module 11 provided in this application embodiment, as shown below. Figure 3 As shown, the monitoring system of the adaptive security monitoring module 11 is first started to enter the adaptive detection point and adaptive data collection.

[0087] Specifically, the monitoring system is usually started by the user, or can be configured to start automatically upon system boot; adaptive detection points correspond to the dynamic deployment of the aforementioned detection points, which can be determined based on system version, user needs, etc., and the detection points can be dynamically adjusted based on risk level assessment results and call frequency, etc.; adaptive data collection corresponds to the dynamic adjustment of the aforementioned acquisition rules, which can be dynamically adjusted based on risk level assessment results, call frequency, system load, and system usage nodes, etc., to determine the data collection frequency, richness, and information weight.

[0088] After completing the above-mentioned adaptive detection point and adaptive data collection, the data processing process can be entered to preprocess the acquired operational data.

[0089] Specifically, the collected operational data can be parsed, filtered, and have empty fields filled according to the detection method and detection point strategy, so that the dynamic security analysis module 12 can perform data analysis in the future.

[0090] In one possible implementation, the adaptive security monitoring system 10 further includes a circular buffer 13 to store the preprocessed runtime data described above, which is then read by the dynamic security analysis module 12.

[0091] For example, Figure 4 This is another schematic diagram of the distribution of the adaptive security monitoring system 10 provided in the embodiments of this application, such as... Figure 4 As shown, the circular buffer 13 corresponds to a mapped memory block. After the running data obtained by the probe point is processed, the kernel can write the data into the circular buffer 13, and the application layer can read it into the analysis layer (corresponding to the dynamic security analysis module 12).

[0092] In this embodiment, by reading the collected data directly from the circular buffer 13 through the analysis layer, the efficiency of data transmission from the kernel layer to the application layer can be effectively improved; at the same time, service evaluation can be performed based on real-time collected data and attack characteristics to quickly generate judgment results.

[0093] In another embodiment of this application, a complete implementation process for the dynamic security analysis module 12 is also provided.

[0094] For example, Figure 5 This is a schematic diagram illustrating the execution of the dynamic security analysis module 12 provided in this application embodiment, as shown below. Figure 5 As shown, after reading the collected data from the circular buffer 13, data analysis can be performed from two dimensions: the production end and the attack end.

[0095] Specifically, the production side can focus on contextual information such as call stack, parent process, call chain, resource access, and permissions, and build behavioral baselines and detect anomalies based on time-series pattern mining and statistical modeling; the attack side can reconstruct the attack chain and locate penetration points based on the attack signature library, so as to combine multi-dimensional data for real-time threat detection.

[0096] It should be noted that the above-mentioned penetration points correspond to the moment when the vulnerability or flaw is successfully exploited for the first time to gain access and subsequent operation privileges. During the access, the penetration point is in an interactive state, such as downloading files or executing shell commands.

[0097] After completing the data analysis of the production and attack sides, the real-time threat detection and alerting engine can be accessed to generate threat event analysis results and response suggestions based on the anomaly analysis results generated by the production side and the feature matching results obtained by the attack side, and then send them to the application layer.

[0098] Correspondingly, the application layer can output security monitoring information through a visual interface or in the form of files. This security monitoring information includes monitoring duration, number of events collected, number of threats and their corresponding levels, CPU load information, etc. Among them, threat levels can be divided into information level, warning level, error level, and emergency level.

[0099] Compared to existing single-dimensional analysis methods that struggle to fully capture complex attack behaviors and suffer from high false positive or false negative rates, this embodiment combines multi-dimensional data from both the production and attack ends to construct a dynamic security context analysis model, enabling real-time threat detection and attack chain reconstruction.

[0100] The automatic device configuration method provided in this application has three advantages: First, it takes into account both the real-time system status and client needs, adapting to different scenarios by dynamically adjusting monitoring strategies. It can dynamically deploy detection methods based on kernel versions and user requirements, and the kernel module and eBPF compatible detection methods can support lower kernel versions, offering high flexibility. Second, it adjusts the collection strategy according to the real-time system status and load status, enabling real-time response to environmental changes and improving the timeliness of threat detection. It is highly dynamic and dynamically adjusts the richness and frequency of collected data based on the system load status and frequently used nodes, effectively reducing system overhead compared to continuous fixed collection. Third, it utilizes real-time collected system data and combines it with attack characteristics to analyze the status of services in the system in real time, providing threat analysis results and response suggestions, optimizing resource allocation, and avoiding unnecessary performance loss.

[0101] The following is for reference. Figure 6 , Figure 6 A schematic diagram of a communication device suitable for implementing embodiments of this application is shown, such as... Figure 6As shown, the communication device 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes based on a program stored in a read-only memory (ROM) 602 or a program loaded from a storage section 608 into a random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the system's operating instructions. The CPU 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0102] The following components are connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0103] Specifically, according to embodiments of this application, the flowchart above refers to... Figure 2 Any of the described processes can be implemented as a computer software program. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowchart. In such an embodiment, the computer program contains program code for performing the methods shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via communication section 609, and / or installed from removable medium 611. When the computer program is executed by central processing unit (CPU) 601, it performs the functions defined in the system of this application.

[0104] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium compatible with computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0105] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operational instructions of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two connected blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified functions or operational instructions, or using a combination of dedicated hardware and computer instructions.

[0106] The units or modules described in the embodiments of this application can be implemented in software or hardware. The described units or modules can also be housed in a processor; for example, a processor may be described as including a semantic extraction unit, a weight allocation unit, and a determination unit. The names of these units or modules do not necessarily constitute a limitation on the unit or module itself.

[0107] On the other hand, this application also provides a computer-readable storage medium, which may be included in the communication device described in the above embodiments, or may exist independently and not assembled into the communication device. The aforementioned computer-readable storage medium stores one or more programs that, when used by one or more processors, execute the methods described in this application. For example, it may execute... Figure 2 Each step of any of the methods shown.

[0108] This application provides a computer program product including instructions that, when executed, cause the method described in this application to be performed. For example, it can execute... Figure 2 Each step of any of the methods shown.

[0109] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the foregoing disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method of adaptive security monitoring, characterized by, The method comprises: According to the execution attribute information of the access process, the distribution position and the distribution quantity of the plurality of detection points are determined, and the running data generated by the access process in the execution process is obtained by using the plurality of detection points; Based on the security event characteristics of the access process represented by the running data, the abnormal analysis result of the access process is determined, and the detection result of the attack behavior corresponding to the access process is obtained based on the preset attack characteristics; According to the abnormal analysis result and the detection result, the security monitoring information of the access process is generated; the security monitoring information at least includes the detection result of the attack threat event; The running data generated by the access process in the execution process is obtained by using the plurality of detection points, comprising: According to the execution attribute information, the acquisition rule of the plurality of detection points is adjusted, and the running data generated by the access process in the execution process is obtained based on the adjusted acquisition rule; Wherein, the acquisition rule at least includes: acquisition frequency, acquisition data type and acquisition data weight, the acquisition data weight is used to represent the correlation degree between the acquired data and the monitoring target; According to the execution attribute information of the access process, the distribution position and the distribution quantity of the plurality of detection points are determined, comprising: When the execution attribute information represents that the risk level of the access process is higher than the preset risk threshold, the number of the detection points is increased; When the execution attribute information represents that the calling frequency of the access process is higher than the preset calling frequency, the number of the detection points is increased.

2. The adaptive security monitoring method of claim 1, wherein, Based on the security event characteristics of the access process represented by the running data, the abnormal analysis result of the access process is determined, comprising: Based on the time sequence characteristics and statistical characteristics of the security event characteristics, the behavior baseline corresponding to the access process is constructed; Based on the behavior baseline, the abnormal detection is carried out to obtain the abnormal analysis result of the access process.

3. The adaptive security monitoring method of claim 1, wherein, Based on the preset attack characteristics, the detection result of the attack behavior corresponding to the access process is obtained, comprising: Based on the preset attack characteristics, the attack behavior and the attack process corresponding to the access process are restored to obtain the detection result of the attack behavior corresponding to the access process.

4. The self-adaptive security monitoring method of claim 1, wherein, The method further comprises: According to the distribution position, the distribution quantity and the acquisition rule of the plurality of detection points, the running data is preprocessed to determine the abnormal analysis result of the access process based on the preprocessed running data.

5. The self-adaptive security monitoring method of claim 1, wherein, The preset attack characteristics are formed based on the historical abnormal analysis result, or are composed of the attack behaviors in the historical attack database.

6. An adaptive security monitoring system, characterized by The system comprises an adaptive security monitoring module and a dynamic security analysis module; The adaptive security monitoring module is used for determining the distribution position and the distribution quantity of the plurality of detection points according to the execution attribute information of the access process, and obtaining the running data generated by the access process in the execution process by using the plurality of detection points; The dynamic security analysis module is used for determining the abnormal analysis result of the access process based on the security event characteristics of the access process represented by the running data, and obtaining the detection result of the attack behavior corresponding to the access process based on the preset attack characteristics; The dynamic security analysis module is further configured to generate security monitoring information of the access process according to the abnormality analysis result and the detection result; The security monitoring information at least includes a detection result of an attack threat event; The acquiring of the running data generated by the access process in the execution process by the multiple detection points includes: adjusting an acquisition rule of the multiple detection points according to the execution attribute information, and acquiring the running data generated by the access process in the execution process based on the adjusted acquisition rule; The acquisition rule at least includes an acquisition frequency, an acquisition data type, and an acquisition data weight, and the acquisition data weight is used to represent a correlation degree between the acquired data and the monitoring target; The determining of the distribution position and the distribution number of the multiple detection points according to the execution attribute information of the access process includes: when the execution attribute information represents that a risk level of the access process is higher than a preset risk threshold, increasing the number of the detection points; when the execution attribute information represents that a calling frequency of the access process is higher than a preset calling frequency, increasing the number of the detection points.

7. The adaptive security monitoring system of claim 6, wherein, The system further includes a ring buffer, and the ring buffer is used to store the running data acquired by the adaptive security monitoring module, so as to be read by the dynamic security analysis module.

8. A computer program product, characterised in that, The computer program product includes instructions, and when the instructions are executed, the method in any one of claims 1-5 is implemented.

Images